Re: Local admin terminal server

Hi Jordy,

Making the users Administrators is a bad idea. Determine the file/registry/dcom/etc. rights that the application needs to run and grant *only* those to your users.

Two good tools to help you figure this out are filemon and regmon from www.sysinternals.com

For example, you *may* need to grant the users all ntfs permissions except Change Permissions & Take Ownership to the specific program's folder, as well as its specific key under HKLM. Or, perhaps you only need to grant them read/write access to one folder under the specific program's folder.

-TP

Jordy wrote:
Hello

Here is what I got.

Everyone is a local admin of there computer. I have done this with
group polices. It seems to work fine.

I have setup a terminal server and when they connect to the terminal
server using remote desktop, they have admin rights on that server.

I guess to run the application they need Local admin rights..

So my question is :)..

How can this be done. I need admin rights to run the app, but dont
want them to be able to change anything on the TS

Thanks
.

Relevant Pages

  • Re: Must loosen security screws for vendor
    ... It's quite ridiculous for apps to require that users have local admin ... rights but requiring that they be able to logon on to the server is ... How are you able to restrict users to ONLY logon to ... > Can I give them access to it, then take away all of their rights? ...
    (microsoft.public.windows.server.sbs)
  • Re: Developer accounts
    ... Is your question "Can I give them specific rights to do only this without ... except as a local admin" or "What is best practice for developers installing ... SQL Server can be fully managed as a SQL admin ... with giving them administrators rights. ...
    (microsoft.public.windows.server.security)
  • Re: Local Server Security Problem
    ... you dont by any chance have it in a domain and you are logging in as the ... local admin which may be restricted, ... > At the server itself I login with a user with administrator rights on the ... > server and I DON'T have rights to do anything. ...
    (microsoft.public.win2000.security)
  • Re: how to forbid users to connect directly to printers
    ... they have already been granted local admin rights, ... Perhaps this is a silly suggestion, but if you don't give users ... set this to only allow access from the server. ...
    (microsoft.public.windows.server.general)
  • Re: IIS/ASP/SQL Security Error
    ... not a permitted logon. ... > That user has rights to the database and the tables. ... > checked this from SQL Server. ... Grant the user login rights to the server, ...
    (microsoft.public.inetserver.iis.activeserverpages)